Britain's privacy watchdog said on November 7 that Facebook has agreed to suspend using data from UK users of its WhatsApp messaging app for advertisements or product-improvement purposes after the watchdog said consumers weren't properly protected.
The watchdog said the social media giant faces action if it uses such data without valid consent.
The Information Commissioner's Office (ICO) had said in August that it would monitor WhatsApp's new privacy policy, after WhatsApp, acquired by Facebook in 2014, said it would share user data with its parent company to better fight spam and improve users' experiences of both services.
The two companies have also come under scrutiny from the European Union's 28 data protection authorities, who last month requested that WhatsApp pause sharing users' data with its parent company until the appropriate legal protections could be assured.
"We're pleased that they've agreed to pause using data from UK WhatsApp users for advertisements or product improvement purposes," the head of the ICO, Elizabeth Denham, said in a statement. "If Facebook starts using the data without valid consent, they may face enforcement action from my office."
The regulator said it had also asked Facebook and WhatsApp to sign an undertaking committing to better explaining to customers how their data would be used and to give them ongoing control over that data. So far, the companies have not agreed.
"We think consumers deserve a greater level of information and protection, but so far Facebook hasn't agreed," Denham said.
A Facebook spokeswoman said WhatsApp "designed its privacy policy and terms update to give users a clear and simple explanation of how the service works, as well as choice over how their data is used.
"These updates comply with applicable law, and follow the latest guidance from the UK Information Commissioner's Office. We hope to continue our detailed conversations with the ICO and other data protection officials, and we remain open to working collaboratively to address their questions."
Denham said she did not think users had been given enough information about what Facebook would do with their data and that WhatsApp had not obtained valid consent.
Several other European privacy watchdogs, such as Spain's, have said they intend to contact Facebook about WhatsApp's privacy policy change but have not yet done so.
Facebook suggested it would be inappropriate to agree on a specific solution with one regulator before receiving all the others' questions.
Enforcement action could ultimately lead to fines. Such fines are small compared with the revenues of the companies concerned. However, a new EU-wide data protection law coming into force in 2018 would change that with fines of up to 4 percent of global turnover.
Denham said she would keep pushing the issue along with other privacy watchdogs, notably the Irish authority. It has the most sway over Facebook, since the US company's European headquarters are in Ireland.
Facebook says the data WhatsApp collects is extremely limited and only a part of that is then shared with Facebook.
